{"id":"CVE-2025-54589","aliases":["GHSA-8mx2-rjh8-q3jq","PYSEC-2026-1276"],"url":"https://o3.security/vulnerability/CVE-2025-54589","summary":"copyparty Reflected XSS via Filter Parameter","details":"### Summary\nUnauthorized reflected Cross-Site-Scripting when accessing the URL for recent uploads with the `filter` parameter containing JavaScript code.\n\n### Details\nWhen accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping.\nThis vulnerability allows for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users, enabling unwanted actions in the victims browser.\n\n### PoC\nA URL like this will execute `alert(1)`:\n```\nhttps://127.0.0.1:3923/?ru&filter=</script><script>alert(1)</script>\n```","published":"2025-07-31T13:48:41.615Z","modified":"2026-08-12T03:51:40.017174622Z","cvss":{"score":6.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"},"epss":{"score":0.02373,"percentile":0.82717,"asOf":"2026-09-04"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"PyPI","name":"copyparty","fixedVersion":"1.18.7"}],"fix":{"url":"https://github.com/9001/copyparty/commit/a8705e611d05eeb22be5d3d7d9ab5c020fe54c62","label":"9001/copyparty@a8705e6"},"references":[{"type":"WEB","url":"https://github.com/9001/copyparty/releases/tag/v1.18.7"},{"type":"ADVISORY","url":"https://github.com/9001/copyparty/security/advisories/GHSA-8mx2-rjh8-q3jq"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54589.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54589"},{"type":"FIX","url":"https://github.com/9001/copyparty/commit/a8705e611d05eeb22be5d3d7d9ab5c020fe54c62"},{"type":"PACKAGE","url":"https://github.com/9001/copyparty"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:40.017174622Z"}}